Studieplan 2015/2016

Master in Information Security Studieplan 2015/2016 Studieprogramkode MIS Innledning Information technology permeates all aspects of society and has become critical to industry, government, and individual well-being. Securing the vital services and structures and ensuring availability of trustworthy information whenever and wherever it is required has become a field of intensive interdisciplinary research in the recent years. At the same time, information security has become an area of extensive commercial activity with thousands of companies developing and marketing various data protection products. The Master in information security provides the students with knowledge and theoretical background, as well as with the skills and attitudes necessary to succeed in this challenging yet eminently rewarding field. The goals of the study program are achieved through the research-based courses that reflect the research results of the teaching staff to a large extent. In such a way, the students are always offered top-quality courses through which they acquire knowledge that gives them many advantages in their careers. The study program is closely related to the research community Norwegian Information Security Laboratory (NISlab), which also offers bachelor and PhD studies in information security. This research environment consists of professors that are active in research and internationally recognized as experts in their respective fields. NISlab is a member of Forum for Research and Innovation in Security and Communication (FRISC), a Norwegian network of institutions dedicated to cutting-edge research in information security. NISlab also has strong international relations and its collaboration network includes more than 20 research institutions worldwide. Studiets varighet, omfang og nivå This is a two-year master program (120 ECTS credits), which is also available part-time over three or four years. The degree awarded upon completion is Master of Science in Information Security. The program has three tracks: Technology, Digital forensics, and Management. After the first semester, which is common to all the tracks (see the course structure below), the students have to choose which track they are going to pursue. The program qualifies the students to proceed to Ph.D. studies. Forventet læringsutbytte Knowledge The candidate possesses advanced knowledge in the field of information security in general and the following particular topics: computer and network security, security management, incident response, security of critical information infrastructure and legal aspects of information security. The candidate possesses special insight and expertise in information security technology, digital forensics or security management, depending on the chosen program track. 1 / 127

The candidate possesses thorough knowledge of academic theory and methods in the field of information security. The candidate is capable of applying knowledge in new areas within the field of information security. The candidate is familiar with current state-of-the-art in the field of information security. The candidate possesses thorough knowledge of scientific methodology, needed to plan and carry out research and development projects in the field of information security. Skills The candidate is capable of analyzing existing theories, methods and interpretations of theories within the field of information security as well as solving theoretical and practical problems independently. The candidate is capable of using independently relevant methods in research and development in the field of information security. These methods include literature study, logical reasoning and performing scientific experiments together with interpreting their results. The candidate is capable of performing critical analysis of different information sources and applying the results of that analysis in academic reasoning and structuring and formulating scientific problems. The candidate is capable of completing an independent research and development project of moderate size under supervision (example: the master thesis), adhering to the current code of ethics in scientific research. The candidate is capable of carrying out a plan of a research project under supervision. General competence The candidate is capable of analyzing academic, professional and research problems. The candidate is capable of using knowledge and skills to carry out advanced tasks and projects. The candidate is capable of imparting comprehensive independent work in the field of information security. The candidate also mastered the terminology in the field of information security. The candidate is capable of communicating academic issues, analysis and conclusions both with experts in the field of information security and with the general audience. The candidate is capable of contributing to innovation and innovation processes. Målgruppe There are three focus groups for this study program: 1. 2. 3. Undergraduate students entering the program as a continuation of their bachelor degree without any prior work experience. Industry students (or students in the private/public sector in general) looking for a full-time or part-time master program, which is flexible and can be adapted to their employers' needs and their own individual needs. International students: exchange students (arriving for a single semester only), full-time students, and part-time students. Opptakskrav og rangering To qualify for admission, an applicant must have a bachelor degree in computer science or another field relevant for information security (mathematics, electrical engineering, physics, etc.). The applicant must document that he/she has at least 10 ECTS credits in mathematics/statistics and at least 2 / 127

30 ECTS credits in computer science subjects (for example, computer programming, theory of algorithms, databases, computer networking, etc.) at the bachelor level. A grade point average (GPA) of at least C on the bachelor studies is required. Graduate studies in information security require a somewhat different mathematical platform than the one included in most bachelor studies. To master the theoretical topics included in the master program we recommend that the students attend the consultancy sessions related to certain topics in the field of mathematics and computer science, organized occasionally during the course of the studies in the form of various seminars. Studiets innhold, oppbygging og sammensetning The program is offered in a flexible manner to fit well to all the three target groups of students. In general, on-campus presence is required only three times per semester (1-3 days each time), for a start-up session, for mid-term exams/presentations (and a start-up session of the second part of the semester) and for final exams/presentations. All courses are available online, but there will also be sessions on a regular weekly or bi-weekly schedule. The presence on these sessions is not required. The program has three tracks (paths of study): technology, digital forensics, and management. Students have to choose which track they pursue after the first semester, which is common for all the tracks. The common courses in the first semester cover the core topics in both information security technology, forensics and management: Cryptology 1, Applied information security, IT governance, Legal aspects of information security, Digital forensics 1, and Scientific methodology. In the rest of the study program, each track has a set of specific courses. Elective courses, taken in the 3rd semester, are freely chosen from a common pool of electives. The students have to choose their master thesis topics within their chosen tracks. Ordinary mandatory courses from other tracks of the program and courses from the master program in media technology and the CIMET (Color in Informatics and Media Technology) master can be included as electives. Students can also use up to 20 ECTS of the courses at the 3000 level as a part of their master program. These must however not be part of the necessary credits for admission if so, they must be replaced by new credits. Some of the courses listed above can also be flexible regarding time, space and teaching format upon request by the students (typically, a course may be taken in a different semester through self-study and under individual or group supervision). Master-level courses from other institutions can be included as electives or can substitute mandatory courses at the discretion of the program director. The course structure for the part-time students can be composed individually as long the track-specific requirements mentioned above and any course inter-dependencies are respected. The most important course inter-dependencies are the following: 1. Students should start working on their master theses in the semester following the research project planning course, 2. All previous coursework has to be completed before starting work on the master thesis (an exception of 10 missing credits may be tolerated at the discretion of the director of the study program, but only if the missing credits are not relevant for the topic of the master thesis). Study methods Lectures Exercises Project work 3 / 127

Essay/Article writing Independent study Group exercises Lab exercises In addition to the classical study methods requiring presence by the students, the Master program in information security makes extensive use of flexible distance study methods. Every course contains the whole study material in digital form available online, via a special system available to the students once enrolled in the program. Audio recordings of the lectures are available online in most subjects contained in the program and the number of subjects that use video recording of the lectures is increasing very fast as technical possibilities make this form of presentations possible. Video streaming of the lectures is also used, whenever technical possibilities allow this. Many subjects use online exams. Tekniske forutsetninger All the students admitted to the study program are required to use their own lap-top computers. The students that choose to participate in the study program as distance students, need in addition a broadband Internet connection. Software that is needed is mostly freely available on the Internet. In some courses, commercial products such as MatLab, are required. As for the practical computer skills, it is expected that the students are capable of using any contemporary operating system (Microsoft Windows, GNU/Linux, MacOS, etc.) both with a graphical user interface and a command line interface. Sensorordning Most courses have internal examiners, but some of them have external examiners. The subject Research project planning and the master thesis always have an external examiner. Once in a period of maximum 6 years, every subject is required to use an external examiner. Internasjonalisering The students are allowed to travel abroad to do their master theses. The information security group has strong links to many of the leading international academic groups within the field, and the students are encouraged to contact their instructors in the course «Research project planning» to ask for relevant travel opportunities. Klar for publisering Ja Utdanningsnivå Mastergrad Studiekode ved Samordnet Opptak (SO-kode) 207 1011 4 / 127

Master in Information Security Technology full-time track Emnekode Emnets navn O/V *) Studiepoeng pr. semester S1(H) S2(V) S3(H) S4(V) IMT4421 Scientific methodology O 5 IMT4532 Cryptology 1 O 5 IMT4561 Applied Information Security O 5 IMT4571 IT Governance O 5 IMT4591 Legal Aspects of Information Security O 5 IMT4012 Digital Forensics 1 O 5 IMT4152 Socio-technical Security Risk Modeling and Analysis 1 O 5 IMT4582 Network Security O 5 IMT4541 Foundations of Information Security O 5 IMT4552 Cryptology 2 O 5 IMT4621 Biometrics O 5 IMT4122 Software Security Trends O 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 IMT4601 Research Project Planning O 5 IMT4904 Master Thesis O 30 Sum: 30 30 30 30 *) O - Obligatorisk emne, V - Valgbare emne Master in Information Security Digital Forensics full-time track Emnekode Emnets navn O/V *) Studiepoeng pr. semester S1(H) S2(V) S3(H) S4(V) IMT4421 Scientific methodology O 5 IMT4532 Cryptology 1 O 5 IMT4561 Applied Information Security O 5 IMT4571 IT Governance O 5 IMT4591 Legal Aspects of Information Security O 5 IMT4012 Digital Forensics 1 O 5 IMT4612 Machine Learning and Pattern Recognition 1 O 5 IMT4582 Network Security O 5 IMT4641 Computational Forensics O 5 IMT4022 Digital Forensics 2 O 10 IMT4122 Software Security Trends O 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 IMT4601 Research Project Planning O 5 IMT4904 Master Thesis O 30 Sum: 30 30 30 30 *) O - Obligatorisk emne, V - Valgbare emne 5 / 127

Master in Information Security Management full-time track Emnekode Emnets navn O/V *) Studiepoeng pr. semester S1(H) S2(V) S3(H) S4(V) IMT4421 Scientific methodology O 5 IMT4532 Cryptology 1 O 5 IMT4561 Applied Information Security O 5 IMT4571 IT Governance O 5 IMT4591 Legal Aspects of Information Security O 5 IMT4012 Digital Forensics 1 O 5 IMT4152 Socio-technical Security Risk Modeling and Analysis 1 O 5 IMT4582 Network Security O 5 IMT4651 Security as Continuous Improvement O 5 IMT4661 Security Management Dynamics O 5 IMT4841 Security Planning and Incident Management O 10 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 IMT4601 Research Project Planning O 5 IMT4904 Master Thesis O 30 Sum: 30 30 30 30 *) O - Obligatorisk emne, V - Valgbare emne Master in Information Security Technology part-time track (three years) Emnekode Emnets navn O/V *) Studiepoeng pr. semester S1(H) S2(V) S3(H) S4(V) S5(H) S6(V) IMT4421 Scientific methodology O 5 IMT4532 Cryptology 1 O 5 IMT4561 Applied Information Security O 5 IMT4012 Digital Forensics 1 O 5 IMT4152 Socio-technical Security Risk Modeling and Analysis 1 O 5 IMT4582 Network Security O 5 IMT4541 Foundations of Information Security O 5 IMT4552 Cryptology 2 O 5 IMT4571 IT Governance O 5 IMT4591 Legal Aspects of Information Security O 5 Valgemne, 5 ECTS O 5 Valgemne, 5 ECTS O 5 IMT4621 Biometrics O 5 IMT4122 Software Security Trends O 5 Valgemne, 5 ECTS O 5 Valgemne, 5 ECTS O 5 Valgemne, 5 ECTS O 5 IMT4601 Research Project Planning O 5 IMT4904 Master Thesis O 10 20 Sum: 20 20 20 20 20 20 *) O - Obligatorisk emne, V - Valgbare emne 6 / 127

Master in Information Security Digital Forensics part-time track (three years) Emnekode Emnets navn O/V *) Studiepoeng pr. semester S1(H) S2(V) S3(H) S4(V) S5(H) S6(V) IMT4421 Scientific methodology O 5 IMT4532 Cryptology 1 O 5 IMT4561 Applied Information Security O 5 IMT4012 Digital Forensics 1 O 5 IMT4612 Machine Learning and Pattern Recognition 1 O 5 IMT4582 Network Security O 5 IMT4641 Computational Forensics O 5 IMT4122 Software Security Trends O 5 IMT4591 Legal Aspects of Information Security O 5 IMT4571 IT Governance O 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 IMT4022 Digital Forensics 2 O 10 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 IMT4601 Research Project Planning O 5 IMT4904 Master Thesis O 10 20 Sum: 20 20 20 20 20 20 *) O - Obligatorisk emne, V - Valgbare emne Master in Information Security Management part-time track (three years) Emnekode Emnets navn O/V *) Studiepoeng pr. semester S1(H) S2(V) S3(H) S4(V) S5(H) S6(V) IMT4421 Scientific methodology O 5 IMT4532 Cryptology 1 O 5 IMT4561 Applied Information Security O 5 IMT4571 IT Governance O 5 IMT4152 Socio-technical Security Risk Modeling and Analysis 1 O 5 IMT4582 Network Security O 5 IMT4651 Security as Continuous Improvement O 5 IMT4661 Security Management Dynamics O 5 IMT4591 Legal Aspects of Information Security O 5 IMT4012 Digital Forensics 1 O 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 IMT4841 Security Planning and Incident Management O 10 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 Valgemne, 5 ECTS V 5 IMT4601 Research Project Planning O 5 IMT4904 Master Thesis O 10 20 Sum: 20 20 20 20 20 20 *) O - Obligatorisk emne, V - Valgbare emne 7 / 127

Electives Emnekode Emnets navn O/V *) Studiepoeng pr. semester S1(H) S2(V) IMT3491 Ethical Hacking and Penetration Testing V 5 IMT3511 Discrete Mathematics V 10 10 IMT3761 Informasjonskrigføring V 5 IMT4132 IT Rhetorics for Security Risk Managmement V 5 IMT4142 Information Security Economics 1 V 5 IMT4632 Machine Learning and Pattern Recognition 2 V 5 IMT4671 Organizational and Human Aspects of Information Security V 5 IMT4722 Behavioural Biometrics V 5 IMT4741 Intrusion detection and prevention V 5 IMT4751 Wireless communication security V 5 IMT4762 Risk Management 1 V 5 IMT4772 Risk Management 2 V 5 IMT4881 Specialization Course 1 V 5 5 IMT4882 Specialization Course 2 V 10 10 Sum: 0 0 *) O - Obligatorisk emne, V - Valgbare emne 8 / 127

Emneoversikt IMT4421 Scientific methodology - 2015-2016 Emnekode: IMT4421 Emnenavn: Scientific methodology Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Høst Varighet (fritekst): Første halvdel av semesteret Språk: Engelsk Forventet læringsutbytte: Etter endt emne skal studenten Kunnskap kunne analysere sentrale problemstillinger innen vitenskapsteori ha inngående kunnskap om sentrale spørsmål innen vitenskapsteori kjenne sentral terminologi for vitenskapelige arbeider Ferdigheter foreslå en vitenskapelig problemstilling selvstendig kunne planlegge gjennomføringen av et vitenskapelig arbeid kunne søke etter akademiske publikasjoner ved hjelp av sentrale databaser for dette kunne tilrettelegge og analysere data fra vitenskapelige prosjekter Generell kompetanse kunne lese og analysere akademiske publikasjoner kunne rapportere resultater fra vitenskapelige prosjekter, deriblant egenutførte vitenskapelige arbeider ha utviklet bevisste etiske holdninger i forhold til hvordan vitenskapelig metodikk anvendes 9 / 127

Emnets temaer: Introduksjon til vitenskapsteori Hva kjennetegner god forskning Forskningsetikk Forskning som middel til systematisk fremgang Kvantitative og kvalitative forskningsdesign Hva karakteriserer gode problemstillinger og hvordan lager man en Litteraturstudier Metodevalg, inkludert planlegging, gjennomføring, og analyse av eksperimenter/studier. Bruk av forskningsdatabaser for problemløsning og forbedring Behandling av data/statistikk Utarbeidelse av prosjektplan Gjennomføring av risikoanalyse og gjennomførbarhetsanalyse Pedagogiske metoder: Essay Forelesninger Nettbasert Læring Prosjektarbeid Veiledning Pedagogiske metoder (fritekst): The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC s learning management system (Fronter). Skriftlig eksamen, 3 timer Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: Intern og ekstern sensor. Utsatt eksamen (tidl. kontinuasjon): Kontinuasjon/utsatt eksamen august 2016. Tillatte hjelpemidler: Tillatte hjelpemidler (gjelder kun skriftlig eksamen): Engelsk ordbok. Obligatoriske arbeidskrav: Godkjent essay Gjennomført praktisk prosjekt 10 / 127

Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig kobling: Frode Volden Emneansvarlig: Førstelektor Frode Volden Læremidler: Leedy, P D, and Ormrod, J E: "Practical Research, -Planning and design, 9th ed."pearson Educational Int. ISBN-10: 0131365665 Samt tilleggslitteratur, utdelt eller gjort tilgjengelig i Fronter. Klar for publisering: Ja Emneside (URL): http://www.hig.no/imt/mt/emnesider/imt4421 11 / 127

IMT4532 Cryptology 1-2015-2016 Emnekode: IMT4532 Emnenavn: Cryptology 1 Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Høst Varighet (fritekst): First half of the fall semester Språk: Engelsk 12 / 127

Forventet læringsutbytte: Knowledge Skills The candidate possesses advanced knowledge of classical cryptography, as well as of stream ciphers, block ciphers and public key ciphers. The candidate possesses thorough knowledge about theory and scientific methods relevant for cryptology. The candidate is capable of applying his/her knowledge in new fields of cryptology. The candidate is capable of analyzing existing theories, methods and interpretations in the field of cryptology and working independently on solving theoretical and practical problems. The candidate can use relevant scientific methods in independent research and development in cryptology. The candidate is capable of performing critical analysis of various literature sources and applying them in structuring and formulating scientific reasoning in cryptology. The candidate is capable of carrying out an independent limited research or development project in cryptology under supervision, following the applicable ethical rules. General competence The candidate is capable of analyzing relevant professional and research ethical problems in cryptology. The candidate is capable of applying his/her cryptographic knowledge and skills in new fields, in order to accomplish advanced tasks and projects. The candidate can work independently and is familiar with cryptographic terminology. The candidate is capable of discussing professional problems, analyses and conclusions in the field of cryptology, both with specialists and with general audience. The candidate is capable of contributing to innovation and innovation processes. Emnets temaer: 1. Classical cryptography - history of cryptography, fundamentals of information theory and its application in cryptography 2. Symmetric ciphers - stream and block ciphers 3. Asymmetric ciphers - fundamentals, RSA 4. Hash functions and digital signatures. Pedagogiske metoder: Forelesninger Oppgaveløsning Prosjektarbeid 13 / 127

Pedagogiske metoder (fritekst): Lectures Numerical exercises The course will be made accessible to both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC s learning management system (ClassFronter). Project work Skriftlig eksamen, 3 timer Vurdering av prosjekt(er) Written exam, 3 hours, counts for 70% of the final mark Project, counts for 30% of the final mark Both the exam and the project must be passed Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: Evaluated by the lecturer. An external examiner will be used every 4th year. Next time in the school-year 2018/2019. Utsatt eksamen (tidl. kontinuasjon): Re-sit August 2016 for the written examination. The project work (if passed) need not be repeated. Tillatte hjelpemidler: D: Ingen trykte eller håndskrevne hjelpemidler tillatt. Bestemt, enkel kalkulator tillatt. Tillatte hjelpemidler (gjelder kun skriftlig eksamen): Calculator, dictionary Obligatoriske arbeidskrav: None Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig kobling: Slobodan Petrovic Emneansvarlig: Professor Slobodan Petrovic 14 / 127

Læremidler: Books: 1. Introduction to Cryptography and Coding Theory, 2. edition, Trappe W., Washington L., Prentice Hall, 2006, ISBN: 0131981994. 2. Handbook of Applied Cryptography, Menezes A., http://www.cacr.math.uwaterloo.ca/hac Erstatter: IMT4531 Introduction to Cryptology Supplerende opplysninger: There is room for 50 students on the course. The students that have already taken the course IMT3771 "Introduction to cryptology" at the bachelor level and that continue with the master's program in information security at HiG cannot be exempted from taking the course IMT4532 Cryptology 1 on the master's level since the expected learning outcomes and the evaluation methods in these two courses are different (the written exam is different and there is a compulsory project in IMT4532). Klar for publisering: Ja Emneside (URL): http://www.hig.no/imt/emnesider/imt4532 15 / 127

IMT4561 Applied Information Security - 2015-2016 Emnekode: IMT4561 Emnenavn: Applied Information Security Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Høst Språk: Engelsk Forventet læringsutbytte: Knowledge Skills Candidates should have a solid grounding in core concepts of information security and privacy Candidates possess advanced knowledge of security design principles and their influence on security policies and security architecture Candidates have advanced knowledge of common vulnerabilities, attack mechanisms, and methods against computer and information systems Candidates have thorough knowledge on the theory and methods underlying access control as well as of identification and authentication mechanisms Candidates are capable of applying relevant methods for independent analysis and research on security architectures, their vulnerabilities, and potential attacks against these Candidates are able to analyze and critically review literature in the field of information security and are able to apply results from the literature in structuring and formulating arguments and reasoning on information security topics Candidates are able to plan and conduct a limited, guided research exercise based on primary literature resulting in a reasoned and coherent report General Competence Candidates are able to conduct translate knowledge and methods in the area of information security to onvel fields so as to be able to successfully complete advanced tasks and projects in information security Candidates are able to work independently and are familiar with core concepts and problems in information security and security architecture Candidates are able to contribute to innovations and innovative processes, identifying advanced information security problems and approaches contributing to their solution 16 / 127

Emnets temaer: Core concepts in information security and privacy Security design principles Security policies Security architecture: Operating systems and applications Access control principles Identification and authentication Vulnerabilities and attack mechanisms Attack methods and malicious software Database security Pedagogiske metoder: Forelesninger Annet Pedagogiske metoder (fritekst): Lectures Other (tutorials) Other (term paper) The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC s learning management system (ClassFronter). Annet Assessment consists of two parts, pass decision is on cumulative grade of both parts: - Part 1 is a written examination (3 hours), accounting for 67% of grade - Part 2 is a term paper, accounting for 33% of grade. Term paper is evaluated by the lecturer. Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: Evaluated by external and internal examiner. Utsatt eksamen (tidl. kontinuasjon): A new term paper must be provided and the examination must be re-sat next August. Tillatte hjelpemidler: D: Ingen trykte eller håndskrevne hjelpemidler tillatt. Bestemt, enkel kalkulator tillatt. 17 / 127

Tillatte hjelpemidler (gjelder kun skriftlig eksamen): Dictionary, simple calculator Obligatoriske arbeidskrav: None. Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig kobling: Stephen Wolthusen Emneansvarlig: Professor Stephen Wolthusen Læremidler: The following textbooks are the primary references; further recommended reading is provided in the course syllabus. D. Gollmann: Computer Security, 3rd edition Wiley, 2011 M. Bishop: Computer Security: Art and Science. Addison-Wesley, 2003. R. Anderson: Security Engineering: A Guide to Building Dependable Distributed Systems (2nd edition). John Wiley & Sons, Chichester, UK (2008) Erstatter: IMT4162 Information Security and Security Architecture Klar for publisering: Ja 18 / 127

IMT4571 IT Governance - 2015-2016 Emnekode: IMT4571 Emnenavn: IT Governance Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Høst Varighet (fritekst): Oktober - desember Språk: Engelsk 19 / 127

Forventet læringsutbytte: Calder and Watkins define IT Governance as the framework for the leadership, organizational structures and business processes, standards and compliance to these standards, which ensures that the organization s information systems support and enable the achievement of its strategies and objectives. IT Governance is of crucial importance for any organization's ability to safeguarding critical information in the context of growing threats, as well as increasing requirements from national and international regulations. However, IT Governance does not exist "per se", but is based on IT and operational risk management methods, appropriate business continuity / IT disaster recovery management, and the subsequent design, implementation and operation of an appropriate level of organizational and technical information security. This course provides an overview of IT Governance, IT Risk Management, Business Continuity Management and Information Security and their dependencies in general, and the information security standards ISO 27001 / ISO 27002 in particular. After attending the course, candidates should possess the following knowledge: security management as an important input to IT and corporate risk management and as a continuous improvement process the basic concepts of the ISO 27001 / ISO 27002 standard After attending the course, candidates should possess the following skills: master the principles for designing, implementing and auditing ISO 27001-based Information security management system (ISMS), using both organizational and technical building blocks be able to design an appropriate level of IT Risk Management and Information Security for a given organisational context After attending the course, candidates should possess the following general competence: main principles, functions and dependencies of IT Governance, IT Risk Management, Business Continuity Management/IT Disaster Recovery and Information Security Emnets temaer: Introduction to Corporate Governance and subsequent IT Governance The Internal Control System (ICS) Introduction to Compliance Management Introduction to Risk Management and Operational Risk IT-specific Risks and Threats Risk Awareness and Sustainability of Countermeasures The role of IT Audit Introduction to Information Security Introduction to Business Continuity Management/IT Disaster Recovery The Role of IT in Event and Crisis Management Information Security standards and Best Practices (ISO 2700x, CoBIT, Baselining) 20 / 127

Pedagogiske metoder: Annet Pedagogiske metoder (fritekst): Lectures, exercises and homework in between lecture blocks. The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC s learning management system (Fronter). Skriftlig eksamen, 3 timer Final Written Exam, 3 hours Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: Evaluated by the lecturer. An external examiner will be used every 4th year. Next time in the school-year 2018/2019. Utsatt eksamen (tidl. kontinuasjon): Re-sit August 2016 Tillatte hjelpemidler: Tillatte hjelpemidler (gjelder kun skriftlig eksamen): None Obligatoriske arbeidskrav: None Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig kobling: Hannes Lubich Emneansvarlig: Associated Professor Hannes Lubich Læremidler: PDF Version of slides and exercises as published on-line Literature: Alan Calder & Steve Watkins. IT Governance : IT Governance: A Manager's Guide to Data Security and ISO 27001 / ISO 27002. Fourth Edition. Kogan Page. 2008. Peter L. Bernstein, "Against the Gods - the Remarkable Story of Risk", John Wiley & Sons, ISBN 0-471-29563-9,Paperback, 1998 21 / 127

Klar for publisering: Ja 22 / 127

IMT4591 Legal Aspects of Information Security - 2015-2016 Emnekode: IMT4591 Emnenavn: Legal Aspects of Information Security Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Høst Varighet (fritekst): Første del av høstsemester Språk: Norsk, alternativt engelsk Forventet læringsutbytte: Knowledge Skills The candidate possesses advanced knowledge in legal aspects especially relevant for information security. This applies particularly to the legal regulation of matters of importance to safeguarding confidentiality, integrity, access and quality. The candidate is capable of performing critical analysis of various literature sources regarding legal aspects of information security. The candidate is capable of carrying out an independent limited research or development project in legal aspects of information security under supervision, following the applicable ethical rules. General competence The candidate is capable of analyzing relevant professional and research ethical problems in legal aspects of information security. The candidate is capable of applying his/her knowledge about legal aspects of information security in new fields, in order to accomplish advanced tasks and projects. The candidate can work independently and is familiar with legal terminology. Emnets temaer: Generelle bestemmelser om informasjonssikkerhet, særlig innenfor e-forvaltning Sikring av personopplysninger ved innsamling, bearbeiding og lagring av opplysninger Regler for elektronisk kommunikasjon 23 / 127

Pedagogiske metoder: Forelesninger Gruppearbeid Oppgaveløsning Samling(er)/seminar(er) Pedagogiske metoder (fritekst): The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC s learning management system (Fronter). Skriftlig eksamen, 3 timer Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: Intern + ekstern sensor Utsatt eksamen (tidl. kontinuasjon): Kontinuasjon/utsatt eksamen august 2016. Tillatte hjelpemidler: Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig kobling: Lise Nilsen Emneansvarlig: Timelærer Lise Nilsen Læremidler: Se oversikt i emnets rom i Fronter. Klar for publisering: Ja 24 / 127

IMT4012 Digital Forensics 1-2015-2016 Emnekode: IMT4012 Emnenavn: Digital Forensics 1 Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Høst Språk: Engelsk Forutsetter bestått: se engelsk versjon Anbefalt forkunnskap: se engelsk versjon Forventet læringsutbytte: se engelsk versjon Emnets temaer: se engelsk versjon Pedagogiske metoder: Forelesninger Lab.øvelser Prosjektarbeid Muntlig fremføring Skriftlig eksamen, 3 timer Vurdering av prosjekt(er) se engelsk versjon Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: se engelsk versjon 25 / 127

Utsatt eksamen (tidl. kontinuasjon): se engelsk versjon Tillatte hjelpemidler: Tillatte hjelpemidler (gjelder kun skriftlig eksamen): se engelsk versjon Obligatoriske arbeidskrav: se engelsk versjon Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig kobling: Stefan Axelsson Emneansvarlig: Associate Professor Stefan Axelsson Læremidler: se engelsk versjon Supplerende opplysninger: se engelsk versjon Klar for publisering: Ja 26 / 127

IMT4152 Socio-technical Security Risk Modeling and Analysis 1-2015-2016 Emnekode: IMT4152 Emnenavn: Socio-technical Security Risk Modeling and Analysis 1 Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Vår Varighet (fritekst): Andre halvdel av semesteret. Språk: Engelsk Forventet læringsutbytte: Emnets temaer: Pedagogiske metoder: Forelesninger Essay Skriftlig eksamen, 2 timer Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Utsatt eksamen (tidl. kontinuasjon): Kontinuasjon/utsatt eksamen august 2016 for skriftlig eksamen. Tillatte hjelpemidler: Tillatte hjelpemidler (gjelder kun skriftlig eksamen): Ingen 27 / 127

Obligatoriske arbeidskrav: Ingen Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig kobling: Stewart Kowalski Emneansvarlig: Professor Stewart Kowalski Læremidler: Systems Thinking.System Dynamics:Managing Change and Complex. Kambiz. E. Maani, Robert Y. Cavana,2 Ed Pearsons 2007. Roadmap to Information Security, For IT and Infosec Managers, Michael E Whitman, Hervert J Mattord,, Course Technology 2011. Related articles Compendium. Erstatter: IMT4481 Klar for publisering: Ja 28 / 127

IMT4582 Network Security - 2015-2016 Emnekode: IMT4582 Emnenavn: Network Security Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Vår Varighet (fritekst): Språk: Engelsk Anbefalt forkunnskap: Forventet læringsutbytte: Emnets temaer: Pedagogiske metoder: Essay Forelesninger Pedagogiske metoder (fritekst): Annet Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: 29 / 127

Utsatt eksamen (tidl. kontinuasjon): Tillatte hjelpemidler: Tillatte hjelpemidler (gjelder kun skriftlig eksamen): Obligatoriske arbeidskrav: Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig: Adjunct Professor Bernhard Hämmerli Læremidler: Erstatter: IMT4101 Sikkerhet i distribuerte systemer Supplerende opplysninger: Klar for publisering: Ja 30 / 127

IMT4651 Security as Continuous Improvement - 2015-2016 Emnekode: IMT4651 Emnenavn: Security as Continuous Improvement Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Vår Varighet (fritekst): Andre halvdel av vår semesteret Språk: Engelsk Forutsetter bestått: IMT4661 - Security Management Dynamics 31 / 127

Forventet læringsutbytte: Knowledge Skills The candidate possesses thorough knowledge of the fundamentals of security management for continuous improvement, as well as the factors that influence the behavior of security systems with regards to continuous improvement. The candidate possesses advanced knowledge about theory and scientific methods relevant modeling the dynamics of systems, in particular of security systems. The candidate is capable of analyzing existing theories, methods and interpretations in the field of security management and working independently on solving theoretical and practical problems of continuous improvement of security. The candidate can use relevant scientific methods in research and development in security management problems with regards to continuous improvement. The candidate is capable of performing critical analysis of various literature sources and applying them in structuring and formulating scientific reasoning in security management problems with regards to continuous improvement. The candidate is capable of carrying out an independent limited research or development project in security management problems with regards to continuous improvement under supervision, following the applicable ethical rules. The candidate is capable of applying his/her knowledge in problems of in security management with regards to continuous improvement. General competence The candidate is capable of analyzing relevant professional and research ethical problems in security management with regards to continuous improvement. The candidate is capable of applying his/her security management knowledge and skills in new fields, in order to accomplish advanced tasks and projects. The candidate can work independently and is familiar with security management terminology. The candidate is capable of discussing professional problems, analyses and conclusions in the field of security management, both with specialists and with general audience. The candidate is capable of contributing to innovation and innovation processes. Emnets temaer: The quality improvement paradox Security and quality improvement processes Improving the Performance of Computer Security Incident Response Teams (CSIRTs) Incident reporting systems and Learning from incidents Security risks in the transition to Integrated Operations Security-dependent safety. Continuous improvement of security in Critical Infrastructure Pedagogiske metoder: Forelesninger Oppgaveløsning Prosjektarbeid 32 / 127

Pedagogiske metoder (fritekst): Web-enabled course with forum The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC s learning management system (ClassFronter). Flervalgstest(er) Vurdering av prosjekt(er) Two multiple choice exams counting each 15% Two individual projects (papers) counting each 35% Each part must be individually approved of Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: Evaluated by the lecturer. An external examiner will be used every 4th year. Next time in the school-year 2014/2015. Utsatt eksamen (tidl. kontinuasjon): The whole course must be repeated Tillatte hjelpemidler: Obligatoriske arbeidskrav: The course requires active participation in projects both in class and outside class. Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig kobling: Jose J. Gonzalez Emneansvarlig: Professor Jose Gonzalez Læremidler: Written material will be given/sent to the students during the semester. Supplerende opplysninger: Hands-on modelling exercises during class are best carried out in computer lab. Students are encouraged to bring laptops to the classroom. Klar for publisering: Ja 33 / 127

34 / 127

IMT4661 Security Management Dynamics - 2015-2016 Emnekode: IMT4661 Emnenavn: Security Management Dynamics Faglig nivå: Master (syklus 2) Studiepoeng: 5 Varighet: Vår Varighet (fritekst): Første halvdel av vår semesteret Språk: Engelsk 35 / 127

Forventet læringsutbytte: Knowledge Skills The candidate possesses thorough knowledge of the fundamentals of security management, as well as the factors that influence the behavior of security systems with regards to MTO ( man-technology-organization ). The candidate possesses basic knowledge about theory and scientific methods relevant modeling the dynamics of systems, in particular of security systems. The candidate is capable of analyzing existing theories, methods and interpretations in the field of security management and working independently on solving theoretical and practical problems of moderate complexity. The candidate can use relevant scientific methods in research and development in security management problems of moderate complexity. The candidate is capable of performing critical analysis of various literature sources and applying them in structuring and formulating scientific reasoning in security management problems of moderate complexity. The candidate is capable of carrying out an independent limited research or development project in security management problems of moderate complexity under supervision, following the applicable ethical rules. The candidate is capable of applying his/her knowledge in problems of moderate complexity in security management. General competence The candidate is capable of analyzing relevant professional and research ethical problems in security management. The candidate is capable of applying his/her security management knowledge and skills in new fields, in order to accomplish advanced tasks and projects. The candidate can work independently and is familiar with security management terminology. The candidate is capable of discussing professional problems, analyses and conclusions in the field of security management, both with specialists and with general audience. The candidate is capable of contributing to innovation and innovation processes. Emnets temaer: Foundations Security standards from the perspective of change and dynamics Introduction to qualitative system dynamics: Causal loop diagrams; System archetypes Modelling security management dynamics using system archetypes and causal loop diagrams Introduction to quantitative system dynamics: Causal structure and dynamic behaviour. Introduction to stocks and flows. Time delays. Basic system dynamics models of security management. Pedagogiske metoder: Forelesninger Oppgaveløsning Prosjektarbeid 36 / 127

Pedagogiske metoder (fritekst): Web-enabled course with forum The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC s learning management system (ClassFronter). Flervalgstest(er) Vurdering av prosjekt(er) Two multiple choice exams counting each 15% Two individual projects (papers) counting each 35% Each part must be individually approved of Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: Evaluated by the lecturer. An external examiner will be used every 4th year. Next time in the school-year 2014/2015. Utsatt eksamen (tidl. kontinuasjon): The whole course must be repeated. Tillatte hjelpemidler: Obligatoriske arbeidskrav: The course requires active participation in projects both in class and outside class. Ansvarlig avdeling: Avdeling for informatikk og medieteknikk Emneansvarlig kobling: Jose J. Gonzalez Emneansvarlig: Professor Jose Gonzalez Læremidler: Literature: Maani, Kambiz E.; Cavana, Robert Y. Systems Thinking And Modelling. Pearson Education. 9781877371035. Lectures, exercises and projects by Jose J. Gonzalez in Classfronter 37 / 127

Erstatter: IMT4111 Sikkerhetsledelse Supplerende opplysninger: Hands-on modelling exercises during class are best carried out in computer lab. Students are encouraged to bring laptops to the classroom. Klar for publisering: Ja 38 / 127

IMT4841 Security Planning and Incident Management - 2015-2016 Emnekode: IMT4841 Emnenavn: Security Planning and Incident Management Faglig nivå: Master (syklus 2) Studiepoeng: 10 Varighet: Vår Varighet (fritekst): Ett semester Språk: Norsk, alternativt engelsk Forventet læringsutbytte: Kunnskap Studenten har etter fullført emne generell kunnskap om sikkerhetsplanlegging og hendelseshåndtering samt fordypning i ett av emnets temaer gjennom det selvstendige prosjektarbeidet. Den generelle kunnskapen omfatter beredskapsplanlegging for håndering av forretningskritiske hendelser. Det blir lagt vekt på både mindre hendelser og større hendelser hvor det kan være nødvendig å flytte drift til en annen lokasjon. Ferdigheter Studenten er i stand til å utarbeide beredskapsplaner for større og mindre informasjonssikkerhetshendelser. Studenten er i stand til å lede planleggingsprossesen på en selvstendig måte. Generell kompetanse Studenten er i stand til selvstendig å fremskaffe informasjon/litteratur som omhandler sikkerhetsplanlegging og hendelseshåndering. Videre er studenten i stand til å kritisk vurdere denne informasjonen og bruke den aktivt i beredskapsplanleggingsprossessen. Studenten er i stand til å kommunisere overnevnte informasjon til andre. 39 / 127

Emnets temaer: 1. 2. 3. 4. 5. 6. Introduksjon og overblikk over hendelseshåndtering beredskapsplanlegging. Planlegging for en beredskapsorganisasjon: Risikostyring, risikostyringens begrensninger, hendelsesrapporteringssystemer, konsekvensanalyse Hendelseshåndtering: forberedelse, organisering, preventive tiltak, deteksjon, hendelsesmelding, reaksjon, gjennoppretting, vedlikehold, operasjonelle problemer for CSIRTs, og organisasjonsmodeller for CSIRTS. Katastrofehåndtering: Forberedelse, gjennomføring, drift og vedlikehold. Kontinuitetsplanlegging: Forberedelse, gjennomføring, drift og vedlikehold. Krisehåndtering og menneskelige faktorer. Pedagogiske metoder: Essay Forelesninger Nettbasert Læring Nettstøttet læring Refleksjon Veiledning Pedagogiske metoder (fritekst): The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC s learning management system (ClassFronter). Skriftlig eksamen, 3 timer Vurdering av prosjekt(er) Totalvurdering bestående av 100 poeng hvorav 50 poeng kan oppnåes på prosjektarbeide og 50 poeng på avsluttende 3-timers eksamen. Omregning fra 100-poengskala til A-F-skala skjer i henhold til anbefalt omregningstabell, men emneansvarlig kan i spesielle tilfeller gjøre små justeringer av grenser for å sikre overenstemmelse med de kvalitative beskrivelsene på A-F-skalaen. Både eksamen og prosjektarbeidet må bestås. Prosjektarbeidet består av et selvstendig arbeid hvor studenten selv må fordype seg i et av emnets temaer. Studenten vil bli veiledet og motta tilbakemeldinger på arbeidet underveis. Karakterskala: Bokstavkarakterer, A (best) - F (ikke bestått) Sensorordning: Internal examiner. An external examiner will be used every 4th year. Next time in the school-year 2014/2015. Utsatt eksamen (tidl. kontinuasjon): Ordinær kontinuasjon på skriftlig eksamen Tillatte hjelpemidler: 40 / 127